Lazarus group’s Brambul worm of the former Wannacry
Relationship with WannaCry and Brambul
WannaCry is a ransomware of the North Korean Lazarus Group that hit the pandemic in May 2017.
Attackers earned about $ 150,000 through this ransomware, and the damage from the attack is estimated at about billions of dollars.
One of the features of WannaCry is that it replicates itself and distributes it to an accessible network, similar to a worm, and is distributed primarily through SMB vulnerabilities and email.
Prior to WannaCry, the Lazarus group deployed a worm that behaved in a similar way, one of which is the worm named Brambul.
WannaCry is a mutation of the ransomware form of this worm called Brambul.
Brambul was created in 2009 and began to be distributed. After 10 years, it’s not dangerous compared to other malware, but it can still harm computers with vulnerable versions and settings.
Analysis
MD5 : [f024ff4176f0036f97ebc95decfd1d5e]
Running the file does not seem to have any effect on your screen.
There is no packing or obfuscation, so it is easy to analyze.
Thanks to this, you can roughly predict behavior with just the strings contained within the file.
Strings in file
Based on the above information, you can infer emails, IP addresses, registry changes, shared folder access, and related processes.
Start of behavior
When the program starts up, it calls the WSAStartup function to check if a network connection is available.
Get the user’s name (the name of the PC). For my PC, I got the value “swan”.
Then push the string “gmail.com” onto the stack and call dnsquery as follows:
After that, the user’s name is verified as “System”, and the behavior is divided into two routine to the result.
First routine
In this case, we call the sub_402900 subroutine, which generates IP addresses randomly after a few GetTickCounts.
It will try to connect to 445 port (SMB port) with randomly generated IP.
If the connection to the SMB port is successful, the connection to the IPC is attempted.
If the connection to IPC succeeds, the administrator account accesses the SCM database and performs malicious actions.
1. Send mail using the SMTP protocol to the specified subject at whiat1001@gmail.com
2. Access shared folder with admin
3. Create a Windows Genuine Logon Manager (wglmgr) Service
4. Create a Microsoft Windows Genuine Updater (wgudtr) Service
5. Generate crss.exe executable
These generated services and executables seem to cause the routine to self-replicate and propagate, after which the first routine is terminated.
Second routine
As soon as the second routine starts, three subroutines are called: sub_401ba0, sub_401b30, and sub_401040.
— sub_401ba0
Create the lsasvc.exe file and run the process.
Afterwards, access the shared folder as admin like the first routine.
— sub_401b30
By adding a value named “WindowsUpdate” to the registry “Software \ Microsoft \ Windows \ CurrentVersion \ Run” path, the process will automatically run each time the computer is turned on.
— sub_401040
Similar to what it did at the beginning of the program run, the gethostname function gets the user’s name.
After the three subroutines are executed, the GetVersion function is used to get the version of the operating system.
I could see that it was classified as “WinNt”, “Win2000”, “WinVista”, “Win2003”, “WinXp”, and “Unkonwn”.
After that, it push the string whiat1001@gmail.com onto the stack and call the sub_401430 subroutine to send the data using the SMTP protocol. The sending account and mail server are the same as whiat1001 and gmail.com, but after pretending the sender account to johnS203@yahoo.com, the process ends. In sub_401430 we could see the strings related to SMTP and mail headers.
Behavior result
1. SMB, IPC ,SCM Database access attempt with random IPs for self-copy and distribution
2. Send mail using the SMTP protocol, pretending whiat1001@gmail.com as johnS203@yahoo.com
3. Access shared folder as admin
4. Create the Windows Genuine Logon Manager (wglmgr) service
5. Create the Microsoft Windows Genuine Updater (wgudtr) service
6. Create crss.exe executable
7. Create and run lsasvc.exe
8. Add “WindowsUpdate” Value to the registry “Software \ Microsoft \ Windows \ CurrentVersion \ Run” path
